RubyGems - pangea - Versions diffs - 0.0.45 → 0.0.46 - Mend

pangea 0.0.45 → 0.0.46

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (2051) hide show

data/lib/pangea/resources/aws_s3_object/types.rb DELETED Viewed

@@ -1,215 +0,0 @@
-# frozen_string_literal: true
-# Copyright 2025 The Pangea Authors
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-require 'dry-struct'
-require 'pangea/resources/types'
-require 'pathname'
-module Pangea
-  module Resources
-    module AWS
-      module Types
-      # Type-safe attributes for AWS S3 Object resources
-      class S3ObjectAttributes < Dry::Struct
-        transform_keys(&:to_sym)
-        # Bucket name (required)
-        attribute :bucket, Resources::Types::String
-        # Object key (required)
-        attribute :key, Resources::Types::String
-        # Source file path (optional, mutually exclusive with content)
-        attribute? :source, Resources::Types::String.optional
-        # Content to upload (optional, mutually exclusive with source)
-        attribute? :content, Resources::Types::String.optional
-        # Content type (optional)
-        attribute? :content_type, Resources::Types::String.optional
-        # Content encoding (optional)
-        attribute? :content_encoding, Resources::Types::String.optional
-        # Content language (optional)
-        attribute? :content_language, Resources::Types::String.optional
-        # Content disposition (optional)
-        attribute? :content_disposition, Resources::Types::String.optional
-        # Cache control (optional)
-        attribute? :cache_control, Resources::Types::String.optional
-        # Expires header (optional)
-        attribute? :expires, Resources::Types::String.optional
-        # Storage class (optional)
-        attribute? :storage_class, Resources::Types::String.enum(
-          'STANDARD', 'REDUCED_REDUNDANCY', 'STANDARD_IA', 'ONEZONE_IA',
-          'INTELLIGENT_TIERING', 'GLACIER', 'DEEP_ARCHIVE', 'GLACIER_IR'
-        ).optional
-        # Object ACL (optional)
-        attribute? :acl, Resources::Types::String.enum(
-          'private', 'public-read', 'public-read-write', 'authenticated-read',
-          'aws-exec-read', 'bucket-owner-read', 'bucket-owner-full-control'
-        ).optional
-        # Server-side encryption (optional)
-        attribute? :server_side_encryption, Resources::Types::String.enum('AES256', 'aws:kms').optional
-        # KMS key ID for encryption (optional)
-        attribute? :kms_key_id, Resources::Types::String.optional
-        # Metadata (optional)
-        attribute :metadata, Resources::Types::Hash.map(Resources::Types::String, Resources::Types::String).default({})
-        # Tags (optional)
-        attribute :tags, Resources::Types::AwsTags.default({})
-        # Website redirect location (optional)
-        attribute? :website_redirect, Resources::Types::String.optional
-        # Object lock mode (optional)
-        attribute? :object_lock_mode, Resources::Types::String.enum('GOVERNANCE', 'COMPLIANCE').optional
-        # Object lock retain until date (optional)
-        attribute? :object_lock_retain_until_date, Resources::Types::String.optional
-        # Object lock legal hold status (optional)
-        attribute? :object_lock_legal_hold_status, Resources::Types::String.enum('ON', 'OFF').optional
-        # Expected bucket owner for multi-account scenarios
-        attribute? :expected_bucket_owner, Resources::Types::String.optional
-        # Custom validation
-        def self.new(attributes = {})
-          attrs = super(attributes)
-          # Validate mutually exclusive content sources
-          if attrs.source && attrs.content
-            raise Dry::Struct::Error, "source and content are mutually exclusive - specify only one"
-          end
-          # Validate at least one content source is provided
-          unless attrs.source || attrs.content
-            raise Dry::Struct::Error, "either source or content must be specified"
-          end
-          # Validate source file exists if provided
-          if attrs.source && !File.exist?(attrs.source)
-            raise Dry::Struct::Error, "source file '#{attrs.source}' does not exist"
-          end
-          # Validate KMS encryption configuration
-          if attrs.server_side_encryption == 'aws:kms' && attrs.kms_key_id.nil?
-            raise Dry::Struct::Error, "kms_key_id is required when using aws:kms encryption"
-          end
-          # Validate object lock configuration consistency
-          if attrs.object_lock_mode && attrs.object_lock_retain_until_date.nil?
-            raise Dry::Struct::Error, "object_lock_retain_until_date is required when object_lock_mode is specified"
-          end
-          if attrs.object_lock_retain_until_date && attrs.object_lock_mode.nil?
-            raise Dry::Struct::Error, "object_lock_mode is required when object_lock_retain_until_date is specified"
-          end
-          attrs
-        end
-        # Helper methods
-        def has_source_file?
-          !source.nil?
-        end
-        def has_inline_content?
-          !content.nil?
-        end
-        def encrypted?
-          !server_side_encryption.nil?
-        end
-        def kms_encrypted?
-          server_side_encryption == 'aws:kms'
-        end
-        def has_metadata?
-          metadata.any?
-        end
-        def has_tags?
-          tags.any?
-        end
-        def object_lock_enabled?
-          !object_lock_mode.nil?
-        end
-        def legal_hold_enabled?
-          object_lock_legal_hold_status == 'ON'
-        end
-        def is_website_redirect?
-          !website_redirect.nil?
-        end
-        def source_file_extension
-          return nil unless source
-          File.extname(source).downcase
-        end
-        def inferred_content_type
-          return content_type if content_type
-          return nil unless source
-          # Basic MIME type inference based on file extension
-          case source_file_extension
-          when '.html', '.htm' then 'text/html'
-          when '.css' then 'text/css'
-          when '.js' then 'application/javascript'
-          when '.json' then 'application/json'
-          when '.xml' then 'application/xml'
-          when '.pdf' then 'application/pdf'
-          when '.jpg', '.jpeg' then 'image/jpeg'
-          when '.png' then 'image/png'
-          when '.gif' then 'image/gif'
-          when '.svg' then 'image/svg+xml'
-          when '.txt' then 'text/plain'
-          when '.md' then 'text/markdown'
-          when '.zip' then 'application/zip'
-          else 'application/octet-stream'
-          end
-        end
-        def estimated_size
-          return content.bytesize if content
-          return File.size(source) if source && File.exist?(source)
-          nil
-        end
-        def content_source_type
-          return 'file' if source
-          return 'inline' if content
-          'unknown'
-        end
-      end
-    end
-      end
-    end
-  end
-end

data/lib/pangea/resources/aws_s3_object_lambda_access_point/resource.rb DELETED Viewed

@@ -1,97 +0,0 @@
-# frozen_string_literal: true
-# Copyright 2025 The Pangea Authors
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-require 'pangea/resources/base'
-require 'pangea/resources/reference'
-require 'pangea/resources/aws_s3_object_lambda_access_point/types'
-require 'pangea/resource_registry'
-module Pangea
-  module Resources
-    module AWS
-      # Create an AWS S3 Object Lambda Access Point with type-safe attributes
-      #
-      # S3 Object Lambda Access Points allow you to add your own code to S3 GET,
-      # HEAD, and LIST requests to modify and process data as it is returned to
-      # applications. You can use Object Lambda to present different views of the
-      # same data to multiple applications.
-      #
-      # @param name [Symbol] The resource name
-      # @param attributes [Hash] S3 object lambda access point attributes
-      # @return [ResourceReference] Reference object with outputs and computed properties
-      def aws_s3_object_lambda_access_point(name, attributes = {})
-        # Validate attributes using dry-struct
-        ol_attrs = S3ObjectLambdaAccessPoint::Types::S3ObjectLambdaAccessPointAttributes.new(attributes)
-        # Generate terraform resource block via terraform-synthesizer
-        resource(:aws_s3_object_lambda_access_point, name) do
-          # Access point name
-          name ol_attrs.name
-          # Configuration block
-          configuration do
-            # Supporting access point ARN
-            supporting_access_point ol_attrs.configuration[:supporting_access_point]
-            # Transformation configurations
-            ol_attrs.configuration[:transformation_configuration].each do |transform|
-              transformation_configuration do
-                # Supported actions
-                actions transform[:actions]
-                # Content transformation with Lambda function
-                content_transformation do
-                  aws_lambda do
-                    function_arn transform[:content_transformation][:aws_lambda][:function_arn]
-                    if transform[:content_transformation][:aws_lambda][:function_payload]
-                      function_payload transform[:content_transformation][:aws_lambda][:function_payload]
-                    end
-                  end
-                end
-              end
-            end
-          end
-          # Optional account ID
-          account_id ol_attrs.account_id if ol_attrs.account_id
-        end
-        # Return resource reference with available outputs
-        ResourceReference.new(
-          type: 'aws_s3_object_lambda_access_point',
-          name: name,
-          resource_attributes: ol_attrs.to_h,
-          outputs: {
-            id: "${aws_s3_object_lambda_access_point.#{name}.id}",
-            arn: "${aws_s3_object_lambda_access_point.#{name}.arn}",
-            alias: "${aws_s3_object_lambda_access_point.#{name}.alias}",
-            domain_name: "${aws_s3_object_lambda_access_point.#{name}.domain_name}"
-          },
-          computed: {
-            supporting_access_point: ol_attrs.supporting_access_point,
-            transformation_count: ol_attrs.transformation_count,
-            lambda_functions: ol_attrs.lambda_functions,
-            supported_actions: ol_attrs.supported_actions,
-            has_payload: ol_attrs.has_payload?
-          }
-        )
-      end
-    end
-  end
-end
-# Auto-register this module when it's loaded
-Pangea::ResourceRegistry.register(:aws, Pangea::Resources::AWS)

data/lib/pangea/resources/aws_s3_object_lambda_access_point/types.rb DELETED Viewed

@@ -1,106 +0,0 @@
-# frozen_string_literal: true
-# Copyright 2025 The Pangea Authors
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-require 'dry-struct'
-module Pangea
-  module Resources
-    module AWS
-      module S3ObjectLambdaAccessPoint
-        # Common types for S3 Object Lambda Access Point configurations
-        class Types < Dry::Types::Module
-          include Dry.Types()
-          # S3 Object Lambda Access Point Name constraint
-          ObjectLambdaAccessPointName = String.constrained(
-            min_size: 3,
-            max_size: 45,
-            format: /\A[a-z0-9\-]+\z/
-          )
-          # Lambda Function ARN constraint
-          LambdaFunctionArn = String.constrained(
-            format: /\Aarn:aws:lambda:[a-z0-9\-]*:[0-9]{12}:function:[a-zA-Z0-9\-_]+\z/
-          )
-          # S3 Access Point ARN constraint
-          AccessPointArn = String.constrained(
-            format: /\Aarn:aws:s3:[a-z0-9\-]*:[0-9]{12}:accesspoint\/[a-z0-9\-]+\z/
-          )
-          # Object Lambda supported actions
-          SupportedAction = String.enum(
-            'GetObject',
-            'HeadObject',
-            'ListObjects',
-            'ListObjectsV2'
-          )
-          # Transformation Configuration
-          TransformationConfiguration = Hash.schema({
-            actions: Array.of(SupportedAction),
-            content_transformation: Hash.schema({
-              aws_lambda: Hash.schema({
-                function_arn: LambdaFunctionArn,
-                function_payload?: String.optional
-              })
-            })
-          })
-        end
-        # S3 Object Lambda Access Point attributes with comprehensive validation
-        class S3ObjectLambdaAccessPointAttributes < Dry::Struct
-          include Types[self]
-          # Required attributes
-          attribute :configuration, Hash.schema({
-            supporting_access_point: AccessPointArn,
-            transformation_configuration: Array.of(TransformationConfiguration).constrained(min_size: 1)
-          })
-          attribute :name, ObjectLambdaAccessPointName
-          # Optional attributes
-          attribute? :account_id, String.constrained(format: /\A\d{12}\z/).optional
-          # Computed properties
-          def supporting_access_point
-            configuration[:supporting_access_point]
-          end
-          def transformations
-            configuration[:transformation_configuration]
-          end
-          def transformation_count
-            transformations.length
-          end
-          def lambda_functions
-            transformations.map { |t| t[:content_transformation][:aws_lambda][:function_arn] }
-          end
-          def supported_actions
-            transformations.flat_map { |t| t[:actions] }.uniq
-          end
-          def has_payload?
-            transformations.any? { |t| t[:content_transformation][:aws_lambda][:function_payload] }
-          end
-        end
-      end
-    end
-  end
-end

data/lib/pangea/resources/aws_sagemaker_domain/CLAUDE.md DELETED Viewed

@@ -1,253 +0,0 @@
-# AWS SageMaker Domain - Implementation Notes
-## Resource Overview
-The `aws_sagemaker_domain` resource implements SageMaker Studio domain management with comprehensive MLOps-focused validation and enterprise security features. This is the foundational resource for SageMaker Studio, providing the environment where data scientists and ML engineers work.
-## Key Implementation Features
-### 1. Comprehensive ML-Specific Validation
-**Authentication Mode Validation**:
-- SSO vs IAM mode consistency checking
-- Execution role identity configuration validation
-- Single sign-on managed application requirements
-**VPC and Network Security**:
-- Multi-AZ subnet requirement validation (minimum 2 subnets)
-- VPC-only access mode security requirements
-- Custom security group management validation
-- App network access type consistency checking
-**Resource Specification Validation**:
-- ML instance type enumeration and validation
-- Lifecycle configuration ARN format validation
-- SageMaker image and version ARN validation
-### 2. Enterprise Security Features
-**Encryption and Key Management**:
-- KMS key validation (ARN, alias, or key ID formats)
-- Encryption at rest configuration
-- Canvas workspace encryption settings
-**Access Control**:
-- IAM execution role permission validation
-- Security group reference validation
-- Notebook sharing and output control
-**Network Isolation**:
-- VPC-only access mode support
-- Customer-managed security groups
-- Domain boundary security group management
-### 3. Advanced Application Integration
-**SageMaker Canvas**:
-- Time series forecasting settings with Amazon Forecast integration
-- Model registry cross-account configuration
-- Workspace settings with S3 artifact paths
-**R Studio Server Pro**:
-- Domain execution role configuration
-- Default resource specifications
-- R Studio Connect and package manager URL settings
-**Jupyter and Kernel Gateway**:
-- Custom image and lifecycle configuration support
-- Code repository integration
-- Default resource specifications
-### 4. MLOps and Governance Features
-**Security Scoring**:
-```ruby
-def security_score
-  score = 0
-  score += 20 if supports_vpc_only?
-  score += 15 if uses_custom_kms_key?
-  score += 10 if has_custom_security_groups?
-  score += 15 if uses_sso_auth?
-  score += 10 if subnet_count >= 3
-  [score, 100].min
-end
-```
-**Compliance Status**:
-- Automated security configuration validation
-- Best practices compliance checking
-- Issue identification and recommendations
-**Cost Estimation**:
-- Domain and compute cost calculations
-- Storage cost estimation for EFS
-- Usage-based pricing considerations
-## Type System Architecture
-### Core Types
-**SageMakerDomainExecutionRole**:
-- IAM role ARN format validation
-- SageMaker service trust relationship requirements
-- Required policy validation framework
-**SageMakerDomainAuthMode**:
-- SSO vs IAM authentication modes
-- Integration with AWS SSO requirements
-- Identity configuration consistency
-**SageMakerDomainInstanceType**:
-- Comprehensive ML instance type enumeration
-- GPU and CPU instance categories
-- Cost and performance optimization guidance
-### Application-Specific Types
-**SageMakerDomainJupyterServerAppSettings**:
-- Default resource specification validation
-- Lifecycle configuration ARN validation
-- Code repository URL and branch validation
-**SageMakerDomainCanvasAppSettings**:
-- Time series forecasting configuration
-- Model registry settings
-- Workspace S3 path validation
-**SageMakerDomainRStudioServerProAppSettings**:
-- User group and access status management
-- Resource specification validation
-- Integration endpoint configuration
-## Validation Logic
-### Network Configuration Validation
-```ruby
-if attrs[:app_network_access_type] == 'VpcOnly'
-  if attrs[:vpc_id].nil? || attrs[:subnet_ids].nil?
-    raise Dry::Struct::Error, "vpc_id and subnet_ids are required when app_network_access_type is VpcOnly"
-  end
-end
-```
-### Authentication Mode Consistency
-```ruby
-if attrs[:auth_mode] == 'SSO'
-  if attrs[:domain_settings] && attrs[:domain_settings][:execution_role_identity_config] == 'DISABLED'
-    raise Dry::Struct::Error, "execution_role_identity_config cannot be DISABLED when auth_mode is SSO"
-  end
-end
-```
-### Subnet Requirements
-```ruby
-if subnet_ids.size < 2
-  raise Dry::Struct::Error, "SageMaker Domain requires at least 2 subnets in different Availability Zones"
-end
-```
-## Resource Reference Attributes
-The resource reference provides comprehensive attributes for integration:
-**Core Attributes**:
-- `id`, `arn`, `domain_name`, `auth_mode`
-- `vpc_id`, `subnet_ids`, `kms_key_id`
-- `app_network_access_type`
-**Computed Attributes**:
-- `home_efs_file_system_id`: EFS file system for user home directories
-- `security_group_id_for_domain_boundary`: Auto-created security group
-- `url`: Studio domain URL for web access
-**Helper Attributes**:
-- `studio_url`: Alias for the domain URL
-- `is_vpc_only`: Boolean indicator for network access type
-- `uses_sso`: Boolean indicator for authentication mode
-## Integration Patterns
-### Multi-Environment Domain Management
-```ruby
-template :ml_platform do
-  # Development domain with public access
-  aws_sagemaker_domain(:dev_domain, {
-    domain_name: "ml-development",
-    auth_mode: "IAM",
-    app_network_access_type: "PublicInternetOnly"
-  })
-  # Production domain with VPC-only access
-  aws_sagemaker_domain(:prod_domain, {
-    domain_name: "ml-production",
-    auth_mode: "SSO",
-    app_network_access_type: "VpcOnly",
-    kms_key_id: kms_key_ref.arn
-  })
-end
-```
-### Domain with User Profiles and Spaces
-```ruby
-domain_ref = aws_sagemaker_domain(:ml_platform, { ... })
-aws_sagemaker_user_profile(:data_scientist, {
-  domain_id: domain_ref.id,
-  user_settings: {
-    execution_role: data_scientist_role_ref.arn
-  }
-})
-aws_sagemaker_space(:team_space, {
-  domain_id: domain_ref.id,
-  space_name: "data-science-team"
-})
-```
-## Security Best Practices Implementation
-### 1. Network Security
-- Always use VPC-only access for production environments
-- Configure private subnets without internet gateway access
-- Use VPC endpoints for AWS service communication
-- Implement network ACLs for additional security
-### 2. Encryption and Key Management
-- Use customer-managed KMS keys for regulatory compliance
-- Configure encryption for EFS home directories
-- Enable encryption for Canvas workspace artifacts
-- Implement key rotation policies
-### 3. Access Control
-- Use SSO for centralized identity management
-- Implement least-privilege IAM roles
-- Configure security groups with minimal required access
-- Enable CloudTrail for API call auditing
-### 4. Compliance and Governance
-- Use security scoring for configuration assessment
-- Implement automated compliance checking
-- Configure resource tagging for cost allocation
-- Enable monitoring for security events
-## Cost Optimization Strategies
-### 1. Instance Type Selection
-- Use smaller instance types for development
-- Implement automatic stopping of idle instances
-- Use Spot instances for training workloads
-- Monitor usage patterns for rightsizing
-### 2. Storage Management
-- Configure EFS lifecycle policies
-- Use S3 Intelligent Tiering for artifacts
-- Implement data retention policies
-- Monitor storage growth patterns
-### 3. Network Optimization
-- Use VPC endpoints to reduce data transfer costs
-- Optimize subnet placement for AZ balance
-- Consider Regional vs Cross-AZ data transfer
-- Monitor network usage patterns
-This implementation provides enterprise-grade SageMaker domain management with comprehensive security, compliance, and cost optimization features suitable for production ML platforms.